Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2021-23965Mozilla developers reported memory safety bugs present in Firefox 84.
- CVE-2021-23979Mozilla developers reported memory safety bugs present in Firefox 85.
- CVE-2021-23978Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7.
- CVE-2021-23977Firefox for Android suffered from a time-of-check-time-of-use vulnerability that allowed a malicious application to read sensitive data from
- CVE-2021-23963When sharing geolocation during an active WebRTC share, Firefox could have reset the webRTC sharing state in the user interface, leading to
- CVE-2021-23953If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin information, when said informa
- CVE-2021-23954Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading to a memory corrupti
- CVE-2021-23955The browser could have been confused into transferring a pointer lock state into another tab, which could have lead to clickjacking attacks.
- CVE-2021-23956An ambiguous file picker design could have confused users who intended to select and upload a single file into uploading a whole directory.
- CVE-2021-23957Navigations through the Android-specific `intent` URL scheme could have been misused to escape iframe sandbox.
- CVE-2021-23958The browser could have been confused into transferring a screen sharing state into another tab, which would leak unintended information.
- CVE-2021-23959An XSS bug in internal error pages could have led to various spoofing attacks, including other error pages and the address bar.
- CVE-2021-23960Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash.
- CVE-2021-23961Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hos
- CVE-2021-23962Incorrect use of the '<RowCountChanged>' method could have led to a user-after-poison and a potentially exploitable crash.
- CVE-2021-23968If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation re
- CVE-2021-23969As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is
- CVE-2021-23970Context-specific code was included in a shared jump table; resulting in assertions being triggered in multithreaded wasm code.
- CVE-2021-23971When processing a redirect with a conflicting Referrer-Policy, Firefox would have adopted the redirect's Referrer-Policy.
- CVE-2021-23972One phishing tactic on the web is to provide a link with HTTP Auth.
- CVE-2021-23973When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the content of that error may
- CVE-2021-23974The DOMParser API did not properly process '<noscript>' elements for escaping.
- CVE-2021-23975The developer page about:memory has a Measure function for exploring what object types the browser has allocated and their sizes.
- CVE-2021-23976When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed de
- CVE-2020-26971Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow on some video drivers.
- CVE-2020-26972The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must ensure that they are not attempting t
- CVE-2020-26973Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed.
- CVE-2020-26974When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly cast to the wrong type.
- CVE-2020-26975When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary headers could have been sp
- CVE-2020-26976When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former, the service worker could have inte